dajiaohuang commented on PR #14229: URL: https://github.com/apache/cloudstack/pull/14229#issuecomment-6392693765
Confirmed on the 4.22 branch: `cloud-setup-encryption.in::processEncryptionStuff()` constructs the same `EncryptionCLI` invocation with double-quoted interpolated classpath, input and key values, then passes the joined argument list through `runCmd()`. That means shell expansion can affect those values there too (not only in `cloud-setup-databases.in`). Please consider applying the same safe quoting approach to this companion script and covering the dynamic arguments with synthetic inputs, or clarify why its invocation is outside this fix. I did not use real credentials or execute either setup script. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
